Many vendors publish their security posture on a trust center. Some documents are public; others are confidential and sit behind an access request that someone at the vendor has to approve. Rather than making you visit the site, request access, wait, download files, and upload them into Drata by hand, the agent does that work as part of the security review. It collects whatever is public right away, submits the access request on your behalf, and re-runs the assessment once the vendor approves it.

This matters because access requests are the slowest part of a vendor review. Waiting on a vendor administrator can take days, and a review that can't start until then is a review that sits. Collecting public documents first means you get a first-pass assessment in minutes and only revisit it when the fuller picture arrives.

After following this article, you'll be able to:

The agent isn't limited to a particular trust center provider. It works with hosted trust centers and self-hosted ones alike — including, for example:

These are illustrative rather than a complete list. If your vendor publishes a trust center somewhere else, add its URL and let the agent try — the core flow is the same wherever the trust center lives: the agent finds it, collects what's public, and helps you get access to the rest. Where a provider's experience differs, this article says so.

Ensure the vendor's Trust Center URL is populated in their vendor profile.

A common mistake is entering a security marketing page rather than the trust center itself. Marketing pages describe a vendor's security program but don't contain the compliance documents the agent needs.

If the page you're about to paste doesn't list downloadable documents and certifications, it's probably not the trust center.

If the vendor has multiple products on SafeBase, include the product-specific URL to target just that product.

Note: If a vendor offers multiple products and you need to evaluate them separately, set up each product as a separate vendor in Drata.

You can also add vendors from the Prospective vendors search, which automatically separates each SafeBase product into its own vendor entry with the correct trust center link.

Expected outcome: The vendor profile shows a Trust Center URL. When you start a security review for that vendor, the agent's checklist includes a Get access to trust center step.

When a vendor has a trust center URL, the security review gains a document collection stage. The agent's checklist shows seven steps rather than the usual six:

The Get access to trust center step appears only for vendors with a trust center URL. Vendors without one follow the standard six-step review.

Once the review starts, the agent finds the trust center and tells you what it can do:

From here you have three paths, and you can combine them:

Expected outcome: The agent confirms it found the vendor's trust center and offers the access options above. Public document collection can begin without any action from you.

You can request access from the chat panel without leaving Drata.

The agent asks for whatever that vendor's trust center requires. Access requirements are set in two layers: the trust center provider defines a baseline, and the vendor can customize it further. So the form varies not just between providers, but between two vendors using the same provider.

In practice that ranges from minimal to fairly detailed:

Some trust centers also require you to accept their terms before they'll consider the request.

There's nothing to configure on your side — the agent reads the requirements and builds the form to match.

Two things stay consistent:

Expected outcome: The access request is submitted with the information that vendor's trust center requires, and the agent confirms what it sent. Document collection continues with public documents while you wait for the vendor's decision.

If the vendor has already granted you access — or sent you an access link directly — you don't need to submit a new request.

The agent uses the link to reach the confidential documents and collect them into the review.

This is useful when someone else on your team already has access, when the vendor sent a link outside Drata, or when you requested access before starting the review in Drata.

Expected outcome: The agent collects the confidential documents using the link you supplied, without waiting on a new access request, and the assessment runs against the full document set.

SafeBase trust centers add a few steps between the vendor's approval and the documents reaching Drata. Here's the whole path.

When the vendor approves your request, you receive an email from their trust center, branded with the vendor's logo and footed with "[Vendor]'s Trust Center is powered by SafeBase."

The email:

Note: If the link has expired, request access again from Drata to trigger a fresh email.

The link takes you to a SafeBase sign-in screen — Sign in to continue to SafeBase by Drata. Enter your email address and select Continue, or use Continue with Google.

Use the same email address the agent submitted with your request. A different address won't be matched to the approved request.

On first arrival you'll see a short welcome dialog — Welcome to [Vendor]'s Trust Center. By proceeding, you agree to the platform's Terms of Use. Select Let's Go to continue.

If your access is covered by an NDA, the trust center displays a reminder that you're viewing it under NDA.

Because the agent started this review, the trust center recognizes it and offers to send you back:

Pick up your review in Drata VRM — It looks like you started your review in Drata VRM. Go back to VRM to continue.

Select Go to Drata VRM to return to the vendor's profile in Drata with your new access applied. ("Drata VRM" is Drata's vendor risk management area — the same place you started.)

Expected outcome: The vendor's Trust Center tab in Drata shows that access has been granted, along with how long it lasts — the duration is set by the vendor, so check the tab rather than assuming a fixed period.

Once access is granted, the agent picks the review back up.

For SafeBase trust centers you'll see a message explaining what changed:

Select Run assessment. The agent collects the complete document set and begins processing. You'll see status messages as it works:

Everything lands in the review's Reports and documents tab, where each file shows its state as the agent works through it: Processing, then Ready for review. Where the agent finds exceptions inside a report, the row says so — for example, Review 9 exceptions found — so you can go straight to the passages that matter.

Because the agent re-evaluates every criterion against the full set, criteria that were previously inconclusive for lack of evidence may resolve to met, partially met, or not met.

Expected outcome: The review's Reports and documents tab lists the full set of trust center documents with their processing status, and the assessment results reflect both public and confidential documents rather than public documents alone.

Some trust center documents sit behind an access request that a vendor administrator has to approve, which can take time or be declined. Rather than waiting, the agent collects whatever is public and lets you assess immediately.

Note: Gaps caused by missing confidential documents typically show up as Inconclusive rather than Not Met. This lets you tell the difference between the vendor hasn't disclosed this yet and the vendor doesn't meet this criterion.

Expected outcome: You have a completed first-pass assessment within minutes of starting the review, labeled Public docs only, with undisclosed criteria marked Inconclusive rather than Not Met.

For vendors with a SafeBase trust center, the vendor profile gains a Trust Center tab, where you can pull in specific documents yourself.

The tab also surfaces the vendor's Introduction and their Compliance badges — the frameworks and certifications they claim, such as SOC 2 Type 2, PCI DSS, and NIST CSF.

Expected outcome: The documents you selected appear in the review's Reports and documents tab and are included the next time the assessment runs.

The trust center integration is a convenience, not a requirement. You can always:

Expected outcome: The review can be completed and finalized whether or not trust center access was granted.

Which trust centers does the agent work with? It isn't limited to specific providers. SafeBase, Vanta, Conveyor, and self-hosted trust centers all work, and those are examples rather than a complete list. If your vendor's trust center is hosted elsewhere, add the URL and let the agent try.

My vendor's trust center provider isn't listed. Will it still work? Most likely. The providers named in this article are illustrative. What matters is that the URL points at a real trust center with documents on it, not a marketing page.

How do I know I've got the trust center URL and not a marketing page? The trust center lists downloadable documents and certifications. A page that only describes the vendor's security program is a marketing page and won't give the agent anything to assess.

Which URL should I use for a vendor with several products on SafeBase? The product-specific URL — for example, https://trust.drata.com/?product=safebase. Without one, the agent collects from the vendor's default product.

Do I have to wait for access before assessing? No. The agent collects public documents and lets you assess immediately, then re-runs with the full set once access is granted.

Why does the access request ask for different information for different vendors? Because access requirements are set by the trust center provider and can be further customized by the vendor. Two vendors on the same provider can ask for different things. The agent reads the requirements and builds the form to match, pre-filling what Drata already knows.

Can I change the email address on an access request? No. It's taken from your Drata account so the vendor's approval reaches you directly.

Who does the access request come from? You. Drata submits it on your behalf using your email address, so the vendor's approval notification arrives in your inbox.

I already have access. Do I need to request it again? No. Select I have an access link, then Provide access details, and paste the link the vendor sent you into the Access link field.

The access link in my SafeBase email didn't work. Those links are valid for a single login and expire after one day. Request access again from Drata to get a fresh link.

Why are some criteria Inconclusive rather than Not Met? Inconclusive means the documentation didn't contain enough information to determine the answer — common when only public documents were available. Not Met means the documentation shows the requirement isn't satisfied. Re-running with confidential documents usually resolves inconclusive results.

Learn how to conduct a security review with the TPRM Agent.